fix(ci): point CodeQL at actions so SAST runs every commit (#72) (#41)

fix(ci): point CodeQL at actions so SAST runs every commit (#72) (#41) #160